PurpleSkjaldborg - Purple-team threat modeling in the browser. Zero d

项目说明

PurpleSkjaldborg

<p align="center">
<img src="static/logo.png" alt="PurpleSkjaldborg Logo" width="280">
</p>

Purple-team threat modeling in the browser. Zero dependencies. One HTML file. Offense *and* defense on one canvas.

> *Skjaldborg* (Old Norse) — a shield wall formation where defenders interlock shields against attackers.
> This tool helps you build that digital shield wall.

---

<p align="center">
<img src="static/demo.gif" alt="PurpleSkjaldborg Demo" width="100%">
</p>

---

What Is This?

PurpleSkjaldborg is a threat modeling tool that combines red team attack paths with blue team defensi in a single diagram. It integrates four industry-standard frameworks:

| Framework | Role in Skjaldborg |
|-----------|-------------------|
| STRIDE | Threat categorization per element (Spoofing, Tampering, Repudiation, Info Disclosure, DoS, EoP) |
| PASTA | 7-stage risk-centric methodology mapped to can |
| MITRE ATT&CK | Ad techniques auto-mapped to Red Team nodes and attack edges — IDs link directly to official MITRE pages |
| MITRE D3FEND | Defensi auto-mapped to Blue Team shields and boundaries — IDs link directly to official MITRE pages |

---

Quick Start

The app loads an AD Attack Chain sample by default. Click Sample in the toolbar to explore all 7 built-in scenarios.

---

Features

Red Team Arsenal

C2 Frameworks — Cobalt Strike, Brute Ratel, Sliver, Havoc, ArachneC2, AdaptixC2

Phishing Infra — E, GoPhish, Tangled, PhishingClub

Pi & Tunneling — Ligolo-ng, Chisel, SSH tunnels, SOCKS proxies, dnscat2, iodine

Living off the Land — LOLBins, LOLDrivers, file transfer utilities

Auto ATT&CK — Every Red Team node ships with pre-mapped MITRE technique IDs

OpSec Ratings — Each tool gets an intrinsic OpSec level (1 Loud → 5 Very Quiet), in the inspector and on the canvas bust% badge

Blue Team Shields

EDR/XDR — CrowdStrike Falcon, Microsoft Defender, Elastic Security, SentinelOne and 15+ more

NDR — Darktrace, AI, ExtraHop, Corelight and more

Network Security — pfSense/OPNsense, Suricata, Squid, WAF, NAC

Cloud Security — Wiz, Prisma Cloud, CNAPP, CSPM, CASB, DLP

Hardening & Deception — ASR/GPO, Kyverno, HoneyPots/Decoys

> Blue tools attach as shields on assets (force-ring + D3FEND co), not floating boxes.

Personas & Human Actors

Model the people in your threat story — not just infrastructure. Persona nodes render as stick figures (not boxes) and carry human-centric properties instead of STRIDE/MITRE assessments:

Actor types — Employee, IT Admin, De, Executi / Contractor, plus security roles (Red Teamer, Blue Teamer) and a generic Threat Actor

Attacker profile *(Threat Actor & Red Teamer only)* — alias/handle, motto/quote, Intent (4 CIA-impact dimensions: 🕵️ Espionage · 💥 Destructive · ⚡ Disruptive · 💰 Cyber-Crime), Capability level (Script Kiddie → Nation-State), moti, sophistication, free-text Needs (goals) and Obstacles (where defenders can intervene)

Human risk profile *(non-attacker personas)* — 🎣 Social Engineering Susceptibility, 🧠 Security Awareness Level, and 💸 Fraud Exposure (Critical → Minimal, e.g. BEC / CEO-fraud payment authority)

⭐ VIP / High-Value Target flag for Executives and IT Admins — surfaces whaling / BEC priority targets, shown with a gold star badge on the node

🎭 Impersonated flag for non-attacker personas — marks an identity spoofed by an attacker (e.g. the "CEO" in a BEC lure); the persona glows red on the canvas

🔑 MFA toggle on auth-capable personas — auto-syncs a D3FEND D3-MFA mapping

Reworked context menu — persona right-click menus adapt per type: intent quick-toggles for attackers; MFA, VIP, impersonated, and fraud-exposure cycling for human personas; free-mo toggle for all

Canvas &

Animated tunnel edges — Red glow for offensi, blue glow for defensive channels

Green glow on encrypted flows — Data flows with *Encrypted in Transit* enabled pulse with a green glow and dashed o

Freehand Trust Boundary — Click on the canvas to draw any polygon; press Esc to finalize. Rendered with smooth Catmull-Rom curves, classical threat-model style

Rectangular boundaries — Trust (blue), Privacy/PII (green), Cloud (gradient), Network (dashed), Red Team, Grey Zone, K8s Namespace, NetworkPolicy

Semantic Auto-arrange — One click organises nodes into 10 semantic zones: External · Network/DMZ · Corporate · Kubernetes · Cloud · IAM · Blue Team · Red Team · Grey Zone · Pi

Semantic context menus — Right-click items adapt to the component type: PII/classification for data stores, STRIDE flags per process type, pri flag for K8s pods, OpSec for red team, internet exposure for assets, and human-actor actions (intent, MFA, VIP, fraud exposure) for personas

Clickable MITRE IDs — Every ATT&CK and D3FEND chip opens the official MITRE technique page in a new tab

Zoom & pan — Scroll to zoom, drag background to pan

Node Badges (Can)

Each node carries corner badges so you can read the threat posture at a glance without opening the inspector:

| Badge | Position | Meaning |
|-------|----------|---------|
| 🌐 Globe | Top-center | Asset is internet-exposed |
| Count pill | Top-right | ATT&CK / STRIDE technique count |
| 🔒 / 🛡️ | Bottom-left | PII lock · Red sword · Blue shield |
| ⚡ Ease score | Bottom-right | Ease of Attack score (0–100, color-coded) |
| % Bust ring | Bottom-right | Red team only — detection bust likelihood |
| Dashed ring | Outer ring | Red team detection risk color (green → red) |
| 🔑 Key | Bottom-center | MFA enabled on an auth-capable node |
| ⭐ Star | Top-right | Persona only — VIP / High-Value Target |
| 💸 Cash | Bottom-left | Persona only — Fraud Exposure (color-coded by se) |
| 🎭 Red glow | Whole node | Persona only — identity is impersonated by an attacker |

Red Team OpSec & Detection

Every red team node gets a live bust likelihood score that reflects how detectable it is by the blue team on the same canvas:

Intrinsic OpSec level (1–5) is assigned per tool type: LOLBins and CDN-fronted C2 are quiet (5), default Cobalt Strike profiles are loud (1–2)

D3FEND co is computed by scanning all blue team nodes and controls on the canvas for techniques that match the red team node's detection surface

Bust risk = detection co × OpSec dampener [1.0, 0.82, 0.65, 0.50, 0.40]

Can a color-coded dashed ring and a bust % badge (bottom-right)

Inspector panel shows the full breakdown: OpSec level pips, bust likelihood bar, detected-by list, and uncovered detection gaps

Ease of Attack

Every non-red-team node gets an automatically computed Ease of Attack score (0–100):

| Score | Label | Color |
|-------|-------|-------|
| 0–19 | Very Hard | 🟢 Green |
| 20–37 | Hard | 🟡 Yellow-green |
| 38–54 | Medium | 🟡 Yellow |
| 55–71 | Easy | 🟠 Orange |
| 72–100 | Critical | 🔴 Red |

The score starts from a base value per node type and is adjusted automatically by:

Number of attack edges pointing at the node

Acti threat flags

Pri container flag

Security controls attached

D3FEND countermeasures mapped

Encrypted at Rest / Encrypted in Transit flows

±5 manual fine-tuning buttons in the inspector

Data Classification (Stores & Databases)

Click any data-holding node (Store, Bucket, DB, Cache, Secret, ConfigMap, Queue…) to access:

Classification level — Unclassified / 🟢 Public / 🔵 Internal / 🟡 Confidential / 🟠 Restricted / 🔴 Secret

Data categories — tag Personal (PII), Health (PHI), Financial (PCI), Biometric, Communications, Legal

🔐 Encrypted at Rest toggle

All settings are accessible from both the inspector panel and the right-click context menu.

Internet Exposure

Flag any asset as reachable from the public internet:

🌐 Globe badge appears on the node at 12 o'clock position (blue, distinct from all other badges)

Inspector toggle — 🌐 Exposed to Internet switch on every node

Context menu — Mark as internet-exposed / Remo exposure for all non-red-team, non-blue-team nodes

The built-in scenarios pre-annotate the correct nodes (firewalls, , email gateways, reverse proxies, phishing infra, cloud APIs, CI/CD platforms, ingress controllers…)

Multi-Factor Authentication (MFA)

Flag MFA on any auth-capable asset or human persona:

🔑 Key badge at the node's 6 o'clock position (emerald, non-o with other badges)

Inspector toggle and context-menu action on supported types (external, API, cloud, IAM, web app, AD, SIEM, firewall, and most personas)

Enabling MFA auto-maps the D3FEND D3-MFA countermeasure and lowers the Ease of Attack score; a missing MFA on an auth-capable node raises it

Analysis & Reporting

Per-boundary risk scoring — Attack surface co

STRIDE matrix — applicability grid for all elements

PASTA stages — 7-stage methodology walkthrough mapped to your diagram

Markdown report export — Full threat model document including STRIDE assessment, ATT&CK/D3FEND lists, PII assets, and data classification metadata

S — Rich self-contained image with:

- Node annotations (ease score, classification level, ATT&CK count, STRIDE flags, encryption status)
- Right-side Analysis Panel with summary metrics, STRIDE bar chart, ATT&CK technique list, D3FEND co, data classification breakdown, red team OpSec assessment, and per-node ease breakdown
- Embedded font, resolved CSS , grid removed
- Zoom & pan — scroll to zoom, drag to pan, + / − / fit buttons

JSON import/export — Save and share full models with your team

---

Built-in Scenarios

| Scenario | Kill Chain | Key Techniques |
|----------|-----------|----------------|
| AD Attack Chain | Phishing → LOLBins → Ligolo-ng pivot → Kerberoasting → ADCS abuse | DCSync, Golden Ticket, E AiTM, WireGuard VPN |
| Cobalt Strike Beacon Drop | GoPhish campaign → Macro payload → Beacon C2 → Lateral mo | Malleable C2, DNS fallback, Kerberoasting, HTTPS egress |
| K8s Cluster Compromise | RCE in pod → SA token theft → etcd dump → Cloud exfil | RBAC abuse, container escape, IRSA pivot, supply chain |
| Cloud Identity Breach (Azure) | Consent phishing → OAuth token → Graph API → Key Vault | Entra ID takeover, MFA bypass, Managed Identity abuse |
| Supply Chain Attack (CI/CD) | Malicious NPM dep → Runner RCE → Backdoored image → Prod | IRSA credential theft, ECR poisoning, ArgoCD deploy |
| Ransomware (Double Extortion) | RDP brute-force → Cobalt Strike → DCSync → Exfil → GPO deploy | BYOVD EDR kill, rclone exfil, deletion |
| Phishing & CEO Fraud (BEC) | OSINT → lookalike domain → spoofed "CEO" email → AP clerk → fraudulent wire → mule account | Impersonation (T1656), Financial Theft (T1657), DMARC/SPF bypass — *malware-free, human-centric* |

All scenarios are pre-annotated with internet-exposed assets, STRIDE flags, ATT&CK/D3FEND techniques, PII zones, and security controls. The CEO Fraud scenario showcases the persona system — human actors with fraud exposure, social-engineering susceptibility, awareness levels, and a executive.

---

Keyboard Shortcuts & Interactions

| Action | Result |
|--------|--------|
| ? | Open Help panel |
| Esc | Stop drawing flows · finalize freehand boundary · cancel tool · deselect |
| Shift + click | Keep node/boundary tool armed (place multiple) |
| Delete / Backspace | Delete selected element |
| F2 | Rename selected element |
| Double-click edge | Toggle attack ↔ data flow |
| Right-click anything | Semantic context menu |
| Scroll | Zoom |
| Drag background | Pan |
| Click flow tool → source → target | Draw edge; tool stays armed — keep wiring or press Esc |
| Click Freehand Boundary → → Esc | Draw and save a polygon trust boundary |
| Click MITRE ID chip | Open official MITRE technique page in new tab |

---

Architecture

Zero dependencies. No React, no D3, no build step. Opens in any modern browser, works offline.

---

Philosophy

Most threat modeling tools make you choose: either you model the attacker *or* you model the defenses. PurpleSkjaldborg lets you do both on the same can purple teams need both perspecti.

Attack paths and defenses rendered together expose gaps

Residual risk scoring quantifies where you're under-defended

Auto-mapped ATT&CK/D3FEND means you don't need encyclopedic MITRE knowledge

OpSec ratings and bust likelihood make red team detectability tangible

Ease of Attack scores gi a prioritized target list

Data classification surfaces which stores are highest-value targets

Internet exposure flags make the attack surface boundary explicit

Personas put the human attack surface on the canvas — social engineering, fraud exposure, and awareness alongside the technical kill chain

Sample kill chains let you start from realistic scenarios and adapt

---

Further Reading

Threat Modeling — Culture & Practice — Foundational concepts on STRIDE, PASTA, and integrating threat modeling into engineering workflows

MITRE ATT&CK — Ad tactics & techniques knowledge base

MITRE D3FEND — Defensi taxonomy

Incident Response Playbooks — Companion IR project

---

License

MIT

---

<p align="center">
<b>PurpleSkjaldborg</b> — Build your digital shield wall.<br>
_{Purple-Team Threat Modeling &middot; STRIDE &middot; PASTA &middot; ATT&CK &middot; D3FEND &middot; Personas &middot; OpSec &middot; Ease of Attack}
</p>

项目信息

开发语言：HTML

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Purple-team threat modeling in the browser. Zero dependencies. One HTML file. Offense and defense on one canvas.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。